@openrig/cli 0.5.1 → 0.5.2

package/daemon/dist/domain/crash-cart-conductor.d.ts

@@ -0,0 +1,173 @@
+/** The shipped closed per-rig union (never widened at the fleet layer). `not_attempted`
+ *  is first-class — a rig the conductor did not reach (no usable snapshot, or cancelled). */
+export type PerRigOutcome = "fully_restored" | "partially_restored" | "failed" | "not_attempted";
+/** One rig's conductor result. `receiptRef` references the durable restore event/attempt
+ *  seq (the ledger lineage) — the conductor RENDERS receipts, it never re-authors them. */
+export interface ConductorRigResult {
+    rigId: string;
+    outcome: PerRigOutcome;
+    receiptRef?: string | number;
+    /** Per-rig triage rows (seats needing operator action) — the fleet
+     *  attention_required is the UNION of these across the sequence. */
+    attention?: AttentionRow[];
+    /** R3 — for a `not_attempted` rig, WHY it was skipped (no honest gap left blank). */
+    reason?: string;
+    /** R3 — the operator action that would let this rig be restored next time. */
+    remediation?: string;
+}
+export interface RestoreConductorDeps {
+    /** Rigs in restore order — KERNEL FIRST (the supervisor), then the rest. */
+    listRigsInOrder: () => Array<{
+        rigId: string;
+        isKernel: boolean;
+    }>;
+    /** Restore ONE rig. Default (wired at the route) = findLatestRestoreUsable(rigId) →
+     *  RestoreOrchestrator.restore(snapshotId) → rollupRestoreRigResult; a rig with no
+     *  usable snapshot returns `not_attempted` (never a silent older/partial substitute). */
+    restoreRig: (rigId: string) => Promise<{
+        outcome: PerRigOutcome;
+        receiptRef?: string | number;
+        attention?: AttentionRow[];
+        reason?: string;
+        remediation?: string;
+    }>;
+    /** Cancel signal, polled at each rig BOUNDARY (stop-before-next-rig). Optional. */
+    isCancelled?: () => boolean;
+}
+export declare class RestoreConductor {
+    private readonly deps;
+    constructor(deps: RestoreConductorDeps);
+    /** Restore the fleet, kernel-first, best-effort, honoring stop-before-next-rig cancel.
+     *  Returns the ordered per-rig sequence (Atom C aggregates it into the FleetRollup). */
+    restoreFleet(opts?: {
+        onRigDone?: (result: ConductorRigResult) => void;
+    }): Promise<ConductorRigResult[]>;
+}
+/** Deps for the DEFAULT per-rig restore — structurally typed so the conductor stays
+ *  decoupled from the full orchestrator (the real wiring passes
+ *  `snapshotRepo.findLatestRestoreUsable` and `RestoreOrchestrator.restore`, whose
+ *  RestoreOutcome satisfies this shape). */
+export interface RestoreRigDeps {
+    /** Newest restore-usable snapshot for the rig, or null (→ `not_attempted`; never a silent substitute). */
+    findLatestRestoreUsable: (rigId: string) => {
+        id: string;
+    } | null;
+    /** The shipped per-rig restore. `onAttemptStarted` yields the restore-started event seq = the receipt ref. */
+    restore: (snapshotId: string, opts?: {
+        onAttemptStarted?: (attemptId: number) => void;
+    }) => Promise<{
+        ok: boolean;
+        result?: {
+            rigResult: PerRigOutcome;
+            nodes?: RestoreNodeLite[];
+        };
+    }>;
+}
+/** One seat of the subset-launch result, structurally the shipped RestoreNodeResult
+ *  subset the triage mapper reads. */
+export interface AdoptSubsetSeat extends RestoreNodeLite {
+    logicalId: string;
+}
+/** Structural slice of RestoreOrchestrator.launchNodeSubset's result — the shipped
+ *  per-seat resume-verification machinery (FR-7: an unverifiable resume fail-closes
+ *  to awaiting-decision carrying the exact `--fresh <logicalId>` remediation). */
+export interface AdoptSubsetResult {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    launched?: AdoptSubsetSeat[];
+    held?: Array<{
+        logicalId: string;
+        reason: string;
+    }>;
+    alreadyRunning?: Array<{
+        logicalId: string;
+    }>;
+    failedTargets?: Array<{
+        logicalId: string;
+        reason: string;
+    }>;
+}
+export interface AdoptRigDeps {
+    /** The rig's DB-running sessions whose tmux panes are ALIVE — the same
+     *  classification restore's 409 guard runs (sessionRegistry rows ×
+     *  tmuxAdapter.hasSession); the conductor never invents a probe. */
+    probeLiveSessions: (rigId: string) => Promise<Array<{
+        sessionName: string;
+        logicalId: string;
+    }>>;
+    /** The shipped no-launch adopt (ClaimService.reconcileSession — the
+     *  `rig reconcile-session` precedent): session state only, never input. */
+    reconcileSession: (sessionName: string) => Promise<{
+        ok: boolean;
+        code?: string;
+        message?: string;
+    }>;
+    /** The rig's full seat roster (logical ids) — adoption's complement is what
+     *  per-seat resume verification must cover. */
+    listRigSeats: (rigId: string) => string[];
+    /** The shipped subset launcher over the NOT-adopted seats. */
+    launchNodeSubset: (rigId: string, logicalIds: string[]) => Promise<AdoptSubsetResult>;
+}
+/** Build the default `restoreRig` dep: COMPOSE findLatestRestoreUsable → restore →
+ *  rigResult. A rig with no usable snapshot is `not_attempted` (restore never runs);
+ *  a restore that fails outright is `failed`. Never re-authors restore logic.
+ *  With `adoptDeps` wired (Amendment 2), a rig whose panes survived takes the ADOPT
+ *  branch above; DEAD panes (and callers without adoptDeps) run unchanged. */
+export declare function createDefaultRestoreRig(_deps: RestoreRigDeps, adoptDeps?: AdoptRigDeps): (rigId: string) => Promise<{
+    outcome: PerRigOutcome;
+    receiptRef?: number;
+    attention?: AttentionRow[];
+    reason?: string;
+    remediation?: string;
+}>;
+export interface RigOrderDeps {
+    /** All (non-archived) rigs on this host — the conductor's fleet scope, v1. */
+    listRigs: () => Array<{
+        id: string;
+        name: string;
+    }>;
+}
+/** R2 — the founder's order: the KERNEL rig (the supervisor, name "kernel") restores
+ *  FIRST, then the remaining rigs in listRigs order. No kernel rig → all rigs, none
+ *  flagged kernel (honest, never fabricated). This is the `listRigsInOrder` source the
+ *  conductor consumes. */
+export declare function listRigsInKernelFirstOrder(deps: RigOrderDeps): Array<{
+    rigId: string;
+    isKernel: boolean;
+}>;
+/** A triage row: a seat + exactly what it needs (picker/auth/remediation), sourced
+ *  from the shipped per-rig restore-check attention projection. The fleet
+ *  `attention_required` is the UNION of these across rigs — a VIEW, not a parallel record. */
+export interface AttentionRow {
+    rigId: string;
+    seat: string;
+    need: string;
+}
+/** Fleet rollup — PURE AGGREGATION over the conductor's per-rig sequence. The per-rig
+ *  outcome stays the shipped CLOSED union (never widened). NO fleet verdict is stored
+ *  here — a stored verdict could drift from the per-rig truth; derive it on demand via
+ *  {@link deriveFleetVerdict}. `not_attempted` is first-class (never folded into failed). */
+export interface FleetRollup {
+    counts: Record<PerRigOutcome, number>;
+    sequence: ConductorRigResult[];
+    attention_required: AttentionRow[];
+}
+/** The fleet verdict is a DERIVED function of the counts — never a stored field. */
+export type FleetVerdict = "all_fully_restored" | "all_failed" | "none_attempted" | "mixed";
+/** A restore node (structural subset of the shipped RestoreNodeResult) — enough to
+ *  build a triage row from the seats that need operator action. */
+export interface RestoreNodeLite {
+    logicalId: string;
+    status: string;
+    error?: string;
+    attentionEvidence?: string | null;
+}
+/** R5 — map a rig's restore nodes → triage rows: the seats needing operator action
+ *  (a LIVE runtime prompt, an unresumable session, or a hard failure), each with its
+ *  EXACT need. Running/resumed nodes are excluded. Never fabricates a need. */
+export declare function attentionRowsFromNodes(rigId: string, nodes: RestoreNodeLite[]): AttentionRow[];
+export declare function aggregateFleetRollup(sequence: ConductorRigResult[]): FleetRollup;
+/** DERIVED f(counts) — computed, never stored (a stored verdict could drift). */
+export declare function deriveFleetVerdict(counts: Record<PerRigOutcome, number>): FleetVerdict;
+//# sourceMappingURL=crash-cart-conductor.d.ts.map

package/daemon/dist/domain/crash-cart-conductor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-conductor.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-conductor.ts"],"names":[],"mappings":"AAWA;6FAC6F;AAC7F,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEjG;2FAC2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B;wEACoE;IACpE,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,eAAe,EAAE,MAAM,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnE;;6FAEyF;IACzF,UAAU,EAAE,CACV,KAAK,EAAE,MAAM,KACV,OAAO,CAAC;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1I,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;CAC7B;AAED,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,oBAAoB;IAEvD;4FACwF;IAClF,YAAY,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAyC/G;AAED;;;4CAG4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,0GAA0G;IAC1G,uBAAuB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClE,8GAA8G;IAC9G,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,KACtD,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,SAAS,EAAE,aAAa,CAAC;YAAC,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACjG;AAUD;sCACsC;AACtC,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;kFAEkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,YAAY;IAC3B;;wEAEoE;IACpE,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACjG;+EAC2E;IAC3E,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrG;mDAC+C;IAC/C,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC1C,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACvF;AAsED;;;;8EAI8E;AAC9E,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,cAAc,EACrB,SAAS,CAAC,EAAE,YAAY,GACvB,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BhJ;AAED,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;0BAG0B;AAC1B,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,YAAY,GACjB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAK7C;AAID;;8FAE8F;AAC9F,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;6FAG6F;AAC7F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,kBAAkB,EAAE,YAAY,EAAE,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,oBAAoB,GAAG,YAAY,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAE5F;mEACmE;AACnE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;+EAE+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,YAAY,EAAE,CAyB9F;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,WAAW,CAahF;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,YAAY,CAMtF"}

package/daemon/dist/domain/crash-cart-conductor.js

@@ -0,0 +1,233 @@
+// B1 — Crash-cart RESTORE CONDUCTOR (daemon-side batch verb). Plan-locked
+// (workspace/missions/release-0.5.2/B1-CRASH-CART-CONDUCTOR-PLAN-2026-08-21, content-hash 84401cd4).
+//
+// Atom B — the conductor CORE. It restores the fleet's rigs in the founder's
+// order (kernel rig first, then the rest, sequential v1), COMPOSING the shipped
+// per-rig restore (findLatestRestoreUsable + RestoreOrchestrator.restore) via an
+// injectable `restoreRig` dep — it does NOT re-author restore logic. Best-effort:
+// one rig's failure never halts the fleet. Cancel is STOP-BEFORE-NEXT-RIG: the
+// in-flight rig runs to its own outcome; rigs not yet started become
+// `not_attempted` (Atom A/C wire discovery + the fleet rollup; Atom D the TUI ⏎).
+export class RestoreConductor {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Restore the fleet, kernel-first, best-effort, honoring stop-before-next-rig cancel.
+     *  Returns the ordered per-rig sequence (Atom C aggregates it into the FleetRollup). */
+    async restoreFleet(opts) {
+        const rigs = this.deps.listRigsInOrder(); // kernel first, then the rest
+        const results = [];
+        // Progress "stream": each rig's result is emitted as it completes so the
+        // route can update a pollable rollup while the fleet restore continues
+        // (the locked async shape — the route answers on-commit, never blocks to
+        // completion). onRigDone stubbed until wired below (RED-first).
+        const record = (result) => {
+            results.push(result);
+            opts?.onRigDone?.(result); // emit progress as each rig completes
+        };
+        for (const rig of rigs) {
+            // Stop-before-next-rig: poll cancel at the rig BOUNDARY, before this rig
+            // starts. A rig already in flight is never interrupted; rigs not yet
+            // reached become `not_attempted` (honest, never silently dropped).
+            if (this.deps.isCancelled?.()) {
+                record({
+                    rigId: rig.rigId,
+                    outcome: "not_attempted",
+                    reason: "cancelled before this rig started (stop-before-next-rig)",
+                    remediation: "re-run the fleet restore to attempt this rig",
+                });
+                continue;
+            }
+            try {
+                const r = await this.deps.restoreRig(rig.rigId);
+                record({
+                    rigId: rig.rigId,
+                    outcome: r.outcome,
+                    receiptRef: r.receiptRef,
+                    attention: r.attention,
+                    reason: r.reason,
+                    remediation: r.remediation,
+                });
+            }
+            catch {
+                // Best-effort continue: one rig's failure never halts the fleet.
+                record({ rigId: rig.rigId, outcome: "failed" });
+            }
+        }
+        return results;
+    }
+}
+/** LIVE-panes branch: adopt every surviving session, then per-seat resume
+ *  verification for the rest, folding into the UNCHANGED closed union. A seat is
+ *  OK iff it yields no triage row (attentionRowsFromNodes is the single non-OK
+ *  authority, so the fold cannot invent a fifth outcome or a second mapping). */
+async function adoptLivePanesRig(rigId, live, deps) {
+    const nodes = [];
+    const adoptedIds = new Set();
+    for (const seat of live) {
+        const adopted = await deps.reconcileSession(seat.sessionName);
+        if (adopted.ok) {
+            adoptedIds.add(seat.logicalId);
+            nodes.push({ logicalId: seat.logicalId, status: "resumed" });
+        }
+        else {
+            nodes.push({
+                logicalId: seat.logicalId,
+                status: "failed",
+                error: `adopt failed for surviving session "${seat.sessionName}": ${adopted.message ?? adopted.code ?? "unknown"}`,
+            });
+        }
+    }
+    if (adoptedIds.size === 0) {
+        // The stamped mis-probe analysis: probe-says-LIVE on a dead rig → adopt fails
+        // EMPTY (honest). Never proceed to launches on a rig the adoption itself just
+        // proved has no surviving session — re-running takes the restore path.
+        return {
+            outcome: "not_attempted",
+            reason: "probe saw live panes but no surviving session could be adopted (panes likely died between probe and adopt)",
+            remediation: "re-run the fleet restore — a genuinely stopped rig takes the snapshot-restore path",
+            attention: attentionRowsFromNodes(rigId, nodes),
+        };
+    }
+    const remaining = deps.listRigSeats(rigId).filter((id) => !adoptedIds.has(id));
+    if (remaining.length > 0) {
+        const subset = await deps.launchNodeSubset(rigId, remaining);
+        if (subset.ok) {
+            for (const n of subset.launched ?? [])
+                nodes.push(n);
+            for (const a of subset.alreadyRunning ?? []) {
+                // r1 LOW: a seat whose ADOPT failed can still be proven LIVE by the launcher
+                // (it classifies targets against tmux itself). The seat is RUNNING — drop the
+                // stale adopt-failure node, or triage would name a running seat as its "need".
+                const staleFailed = nodes.findIndex((n) => n.logicalId === a.logicalId && n.status === "failed");
+                if (staleFailed >= 0)
+                    nodes.splice(staleFailed, 1);
+                nodes.push({ logicalId: a.logicalId, status: "resumed" });
+            }
+            for (const f of subset.failedTargets ?? [])
+                nodes.push({ logicalId: f.logicalId, status: "failed", error: `resume verification could not run: ${f.reason}` });
+            for (const h of subset.held ?? [])
+                nodes.push({ logicalId: h.logicalId, status: "attention_required", attentionEvidence: `held from launch — ${h.reason}` });
+        }
+        else {
+            // A whole-subset refusal (e.g. no usable snapshot) leaves every remaining seat
+            // unverified — each gets a NAMED row; silence here would be the round-10 gap again.
+            for (const id of remaining)
+                nodes.push({ logicalId: id, status: "failed", error: `per-seat resume verification unavailable: ${subset.message ?? subset.code ?? "launch subset failed"}` });
+        }
+    }
+    const attention = attentionRowsFromNodes(rigId, nodes);
+    // R6 closed union, per the amendment: all seats re-attached+verified →
+    // fully_restored; some non-resumable → partially_restored (their exact needs ride
+    // the triage rows). adoptedIds.size > 0 guarantees at least one OK seat here.
+    return attention.length === 0
+        ? { outcome: "fully_restored", attention }
+        : { outcome: "partially_restored", attention };
+}
+/** Build the default `restoreRig` dep: COMPOSE findLatestRestoreUsable → restore →
+ *  rigResult. A rig with no usable snapshot is `not_attempted` (restore never runs);
+ *  a restore that fails outright is `failed`. Never re-authors restore logic.
+ *  With `adoptDeps` wired (Amendment 2), a rig whose panes survived takes the ADOPT
+ *  branch above; DEAD panes (and callers without adoptDeps) run unchanged. */
+export function createDefaultRestoreRig(_deps, adoptDeps) {
+    return async (rigId) => {
+        if (adoptDeps) {
+            const live = await adoptDeps.probeLiveSessions(rigId);
+            // Adopt has NO restore-attempt receipt: its ledger lineage is the
+            // node.reconciled events the shipped adopt emits per seat.
+            if (live.length > 0)
+                return adoptLivePanesRig(rigId, live, adoptDeps);
+        }
+        const snapshot = _deps.findLatestRestoreUsable(rigId);
+        if (!snapshot)
+            // no usable snapshot — never a silent substitute; R3: carry WHY + the fix.
+            return {
+                outcome: "not_attempted",
+                reason: "no restore-usable snapshot for this rig",
+                remediation: "take a snapshot (rig snapshot create) or mark an existing one restore-usable",
+            };
+        let receiptRef;
+        const outcome = await _deps.restore(snapshot.id, {
+            onAttemptStarted: (attemptId) => {
+                receiptRef = attemptId;
+            },
+        });
+        // ok:true → result.rigResult; ok:false WITH a result (e.g. pre-restore validation
+        // fail → `not_attempted`) → its rigResult; ok:false with no result (a hard failure:
+        // snapshot/rig not found, rig not stopped, restore in progress) → `failed`.
+        const outcomeResult = outcome.result?.rigResult ?? "failed";
+        // Triage rows for this rig's seats that need operator action (from the restore
+        // result's nodes) — the shipped per-rig attention, unioned at the fleet layer.
+        const attention = outcome.result?.nodes ? attentionRowsFromNodes(rigId, outcome.result.nodes) : [];
+        return { outcome: outcomeResult, receiptRef, attention };
+    };
+}
+/** R2 — the founder's order: the KERNEL rig (the supervisor, name "kernel") restores
+ *  FIRST, then the remaining rigs in listRigs order. No kernel rig → all rigs, none
+ *  flagged kernel (honest, never fabricated). This is the `listRigsInOrder` source the
+ *  conductor consumes. */
+export function listRigsInKernelFirstOrder(deps) {
+    const all = deps.listRigs();
+    const kernel = all.filter((r) => r.name === "kernel");
+    const rest = all.filter((r) => r.name !== "kernel");
+    return [...kernel, ...rest].map((r) => ({ rigId: r.id, isKernel: r.name === "kernel" }));
+}
+/** R5 — map a rig's restore nodes → triage rows: the seats needing operator action
+ *  (a LIVE runtime prompt, an unresumable session, or a hard failure), each with its
+ *  EXACT need. Running/resumed nodes are excluded. Never fabricates a need. */
+export function attentionRowsFromNodes(rigId, nodes) {
+    const rows = [];
+    for (const n of nodes) {
+        if (n.status === "attention_required") {
+            rows.push({
+                rigId,
+                seat: n.logicalId,
+                need: n.attentionEvidence
+                    ? `live runtime prompt — ${n.attentionEvidence}`
+                    : "live runtime prompt (resume selection / auth) — needs operator",
+            });
+        }
+        else if (n.status === "awaiting-decision") {
+            // BLOCKER 3 — preserve the shipped orchestrator's EXACT error/remediation (it carries the concrete
+            // `--fresh <logicalId>` command and reason); only fall back to the generic sentence when the node
+            // carried none. The exact need reaching the operator IS the door's "seat + exact need" acceptance.
+            rows.push({
+                rigId,
+                seat: n.logicalId,
+                need: n.error ? n.error : "original session not resumable and no --fresh — choose fresh-prime or skip",
+            });
+        }
+        else if (n.status === "failed") {
+            rows.push({ rigId, seat: n.logicalId, need: n.error ? `restore failed: ${n.error}` : "restore failed" });
+        }
+    }
+    return rows;
+}
+export function aggregateFleetRollup(sequence) {
+    // All four closed-union keys initialized — `not_attempted` is first-class, never
+    // absent and never folded into `failed`.
+    const counts = {
+        fully_restored: 0,
+        partially_restored: 0,
+        failed: 0,
+        not_attempted: 0,
+    };
+    for (const r of sequence)
+        counts[r.outcome] += 1;
+    // attention_required = the UNION of per-rig triage rows carried in the sequence (a view).
+    const attention_required = sequence.flatMap((r) => r.attention ?? []);
+    return { counts, sequence, attention_required };
+}
+/** DERIVED f(counts) — computed, never stored (a stored verdict could drift). */
+export function deriveFleetVerdict(counts) {
+    const total = counts.fully_restored + counts.partially_restored + counts.failed + counts.not_attempted;
+    if (total === 0 || counts.not_attempted === total)
+        return "none_attempted";
+    if (counts.fully_restored === total)
+        return "all_fully_restored";
+    if (counts.failed === total)
+        return "all_failed";
+    return "mixed";
+}
+//# sourceMappingURL=crash-cart-conductor.js.map

package/daemon/dist/domain/crash-cart-conductor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-conductor.js","sourceRoot":"","sources":["../../src/domain/crash-cart-conductor.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,qGAAqG;AACrG,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,qEAAqE;AACrE,kFAAkF;AAkClF,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D;4FACwF;IACxF,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,8BAA8B;QACxE,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,EAAE;YAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC;QACnE,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,yEAAyE;YACzE,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;gBAC9B,MAAM,CAAC;oBACL,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,eAAe;oBACxB,MAAM,EAAE,0DAA0D;oBAClE,WAAW,EAAE,8CAA8C;iBAC5D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChD,MAAM,CAAC;oBACL,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA0DD;;;iFAGiF;AACjF,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,IAAuD,EACvD,IAAkB;IAElB,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,uCAAuC,IAAI,CAAC,WAAW,MAAM,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE;aACnH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,8EAA8E;QAC9E,8EAA8E;QAC9E,uEAAuE;QACvE,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,4GAA4G;YACpH,WAAW,EAAE,oFAAoF;YACjG,SAAS,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC;SAChD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;gBAC5C,6EAA6E;gBAC7E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;gBACjG,IAAI,WAAW,IAAI,CAAC;oBAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE;gBACxC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sCAAsC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACpH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE;gBAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9H,CAAC;aAAM,CAAC;YACN,+EAA+E;YAC/E,oFAAoF;YACpF,KAAK,MAAM,EAAE,IAAI,SAAS;gBACxB,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACnK,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,uEAAuE;IACvE,kFAAkF;IAClF,8EAA8E;IAC9E,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC;QAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE;QAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;8EAI8E;AAC9E,MAAM,UAAU,uBAAuB,CACrC,KAAqB,EACrB,SAAwB;IAExB,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACtD,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ;YACX,2EAA2E;YAC3E,OAAO;gBACL,OAAO,EAAE,eAAe;gBACxB,MAAM,EAAE,yCAAyC;gBACjD,WAAW,EAAE,8EAA8E;aAC5F,CAAC;QACJ,IAAI,UAA8B,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC/C,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE;gBAC9B,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;SACF,CAAC,CAAC;QACH,kFAAkF;QAClF,oFAAoF;QACpF,4EAA4E;QAC5E,MAAM,aAAa,GAAkB,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,QAAQ,CAAC;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAOD;;;0BAG0B;AAC1B,MAAM,UAAU,0BAA0B,CACxC,IAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAmCD;;+EAE+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,KAAwB;IAC5E,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK;gBACL,IAAI,EAAE,CAAC,CAAC,SAAS;gBACjB,IAAI,EAAE,CAAC,CAAC,iBAAiB;oBACvB,CAAC,CAAC,yBAAyB,CAAC,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,gEAAgE;aACrE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC5C,mGAAmG;YACnG,kGAAkG;YAClG,mGAAmG;YACnG,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK;gBACL,IAAI,EAAE,CAAC,CAAC,SAAS;gBACjB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4EAA4E;aACvG,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA8B;IACjE,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,MAAM,GAAkC;QAC5C,cAAc,EAAE,CAAC;QACjB,kBAAkB,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC;QACT,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,0FAA0F;IAC1F,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;IACvG,IAAI,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC;IAC3E,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;QAAE,OAAO,oBAAoB,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/daemon/dist/domain/crash-cart-probes.d.ts

@@ -1,10 +1,11 @@
 import type { DaemonStateFile, HealthzProbeResult } from "./crash-cart-detect.js";
-/** Classify a fetch REJECTION into a probe result. ECONNREFUSED = the only strong down signal; an
- *  abort/timeout = unverified; anything else = timeout (conservative — never a fabricated down). */
-export declare function classifyProbeError(err: {
-    code?: string;
-    name?: string;
-}): HealthzProbeResult;
+/** Classify a fetch REJECTION into a probe result — POSITIVE-FORM predicate (guard/orch rail):
+ *  DOWN (refused) ONLY when (a) at least one terminal attempt exists AND (b) EVERY terminal attempt is
+ *  recognizably ECONNREFUSED. Anything else — a timeout, an abort, another code, or a CODE-LESS /
+ *  unrecognized failure — is ambiguous evidence and stays timeout/unverified (a timeout never promotes to
+ *  a confirmed down; the cart never offers RESTORE on partial evidence). "No known-bad sibling" (a negated
+ *  code-Set) erased a code-less sibling; "ALL known-good" (this positive form) closes the whole family. */
+export declare function classifyProbeError(err: unknown): HealthzProbeResult;
 export interface ProbeDeps {
     fetch: (url: string, init?: {
         signal?: AbortSignal;

package/daemon/dist/domain/crash-cart-probes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crash-cart-probes.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAElF;oGACoG;AACpG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAI5F;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;8EAC8E;AAC9E,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW5F;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;8CAC8C;AAC9C,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAY/E"}
+{"version":3,"file":"crash-cart-probes.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAiDlF;;;;;2GAK2G;AAC3G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAInE;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;8EAC8E;AAC9E,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW5F;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;8CAC8C;AAC9C,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAY/E"}

package/daemon/dist/domain/crash-cart-probes.js

@@ -3,14 +3,64 @@
 // proven by the real-daemon-down run.
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-/** Classify a fetch REJECTION into a probe result. ECONNREFUSED = the only strong down signal; an
- *  abort/timeout = unverified; anything else = timeout (conservative — never a fabricated down). */
+/** Collect the TERMINAL ATTEMPTS from a rejection tree — the leaf error nodes that represent an actual
+ *  connect attempt. Node/Undici's global fetch wraps a refused socket as an OUTER `TypeError
+ *  {message:"fetch failed", code:undefined}` → `cause` (single address), or an `AggregateError` whose
+ *  `.errors[]` are the per-address attempts. A node WITH a `cause` or non-empty `errors[]` is a WRAPPER
+ *  (it recurses, never counts as a terminal attempt); a node with neither is a terminal attempt — which
+ *  may carry a `code` (ECONNREFUSED/ETIMEDOUT/…) or NONE at all. A code-less attempt is retained here,
+ *  which a flattened code-Set would erase. Depth-bounded (cycle-safe); a node hit at the cap is treated
+ *  as a terminal attempt (its code, typically absent, then counts — conservatively). */
+const MAX_WALK_DEPTH = 10; // real Undici chains are 2–3 deep; this is generous. Beyond it = UNRESOLVED.
+function collectTerminalAttempts(err) {
+    const attempts = [];
+    const onPath = new Set(); // cycle detection by IDENTITY (a back-edge cannot be resolved)
+    const visit = (e, depth) => {
+        // A non-object rejection (string/undefined/…) is not a resolvable terminal → unknown (non-refused).
+        if (!e || typeof e !== "object") {
+            attempts.push({ unresolved: true });
+            return;
+        }
+        const o = e;
+        // CYCLE: this exact object is already on the current path — it cannot be fully resolved → unknown.
+        if (onPath.has(o)) {
+            attempts.push({ unresolved: true });
+            return;
+        }
+        const children = [];
+        if (o.cause)
+            children.push(o.cause);
+        if (Array.isArray(o.errors))
+            children.push(...o.errors);
+        if (children.length === 0) {
+            // A FULLY-RESOLVED terminal attempt (no cause, no errors): its own code is real evidence.
+            attempts.push({ code: typeof o.code === "string" ? o.code : undefined, name: typeof o.name === "string" ? o.name : undefined });
+            return;
+        }
+        // A WRAPPER (has children). If depth is exhausted, we CANNOT resolve it → record an UNKNOWN attempt;
+        // NEVER reinterpret an unresolved wrapper's OWN code as terminal evidence (exhaustion is not evidence).
+        if (depth >= MAX_WALK_DEPTH) {
+            attempts.push({ unresolved: true });
+            return;
+        }
+        onPath.add(o);
+        for (const c of children)
+            visit(c, depth + 1);
+        onPath.delete(o);
+    };
+    visit(err, 0);
+    return attempts;
+}
+/** Classify a fetch REJECTION into a probe result — POSITIVE-FORM predicate (guard/orch rail):
+ *  DOWN (refused) ONLY when (a) at least one terminal attempt exists AND (b) EVERY terminal attempt is
+ *  recognizably ECONNREFUSED. Anything else — a timeout, an abort, another code, or a CODE-LESS /
+ *  unrecognized failure — is ambiguous evidence and stays timeout/unverified (a timeout never promotes to
+ *  a confirmed down; the cart never offers RESTORE on partial evidence). "No known-bad sibling" (a negated
+ *  code-Set) erased a code-less sibling; "ALL known-good" (this positive form) closes the whole family. */
 export function classifyProbeError(err) {
-    if (err.code === "ECONNREFUSED")
-        return "refused";
-    if (err.name === "AbortError" || err.code === "ETIMEDOUT" || err.code === "UND_ERR_CONNECT_TIMEOUT")
-        return "timeout";
-    return "timeout";
+    const attempts = collectTerminalAttempts(err);
+    const refusedUnanimous = attempts.length > 0 && attempts.every((a) => a.code === "ECONNREFUSED");
+    return refusedUnanimous ? "refused" : "timeout";
 }
 /** Probe `<url>` (a daemon /healthz): 2xx → answered; non-2xx (foreign occupant) → not-openrig; a
  *  rejection is classified (refused/timeout). Bounded by an abort timeout. */

package/daemon/dist/domain/crash-cart-probes.js.map

@@ -1 +1 @@
-{"version":3,"file":"crash-cart-probes.js","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;oGACoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,GAAqC;IACtE,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;QAAE,OAAO,SAAS,CAAC;IACtH,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAe;IAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;IACvD,CAAC;AACH,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAsD,CAAC;QACnG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"crash-cart-probes.js","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;;;wFAOwF;AACxF,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,6EAA6E;AAExG,SAAS,uBAAuB,CAAC,GAAY;IAC3C,MAAM,QAAQ,GAAkE,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,+DAA+D;IACjG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,KAAa,EAAQ,EAAE;QAChD,oGAAoG;QACpG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAA0E,CAAC;QACrF,mGAAmG;QACnG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,MAAoB,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,0FAA0F;YAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QACD,qGAAqG;QACrG,wGAAwG;QACxG,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;2GAK2G;AAC3G,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACjG,OAAO,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAOD;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAe;IAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;IACvD,CAAC;AACH,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAsD,CAAC;QACnG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/daemon/dist/domain/hosts/fanout-contract.d.ts

@@ -6,6 +6,10 @@ export declare const LOCAL_HOST_ID = "local";
 export declare function setSelfHostId(id: string | null): void;
 /** The boot-resolved self-host id, or null before boot has reconciled it. */
 export declare function getSelfHostId(): string | null;
+/** Publish the boot-derived self-host id source (startup, once). null resets (tests). */
+export declare function setSelfHostIdSource(source: string | null): void;
+/** The boot-derived self-host id source, or null before boot has reconciled it. */
+export declare function getSelfHostIdSource(): string | null;
 /**
  * The shared self-resolution convention: does a host token route to THIS host?
  * True for an absent/empty token, the `LOCAL_HOST_ID` positional sentinel, and

package/daemon/dist/domain/hosts/fanout-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fanout-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/fanout-contract.ts"],"names":[],"mappings":"AAUA;;kCAEkC;AAClC,eAAO,MAAM,aAAa,UAAU,CAAC;AAerC,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAE7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACpC,MAAM,GAAE,MAAM,GAAG,IAAiB,GACjC,OAAO,CAIT;AAED;;;;gEAIgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,aAAa,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE/F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,iBAAiB,CAAC;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;kEAE8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;8BAG8B;AAC9B,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED;;iDAEiD;AACjD,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAIpG"}
+{"version":3,"file":"fanout-contract.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/fanout-contract.ts"],"names":[],"mappings":"AAUA;;kCAEkC;AAClC,eAAO,MAAM,aAAa,UAAU,CAAC;AAerC,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAE7C;AAUD,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE/D;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACpC,MAAM,GAAE,MAAM,GAAG,IAAiB,GACjC,OAAO,CAIT;AAED;;;;gEAIgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,aAAa,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE/F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,iBAAiB,CAAC;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;kEAE8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;8BAG8B;AAC9B,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED;;iDAEiD;AACjD,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAIpG"}

package/daemon/dist/domain/hosts/fanout-contract.js

@@ -31,6 +31,21 @@ export function setSelfHostId(id) {
 export function getSelfHostId() {
     return selfHostId;
 }
+// Slice 14 §2c — the id's PROVENANCE, resolved once at boot beside the id itself.
+//
+// Deliberately NOT derived per request: it needs the operator's configured `host.name`, and reading
+// settings inside the /healthz handler put file I/O on the hottest path in the daemon and blew the
+// ps+summary burst latency budget (caught by ps-summary-stall-red). Same lifecycle as the id: set
+// once at boot, read for free thereafter.
+let selfHostIdSource = null;
+/** Publish the boot-derived self-host id source (startup, once). null resets (tests). */
+export function setSelfHostIdSource(source) {
+    selfHostIdSource = source;
+}
+/** The boot-derived self-host id source, or null before boot has reconciled it. */
+export function getSelfHostIdSource() {
+    return selfHostIdSource;
+}
 /**
  * The shared self-resolution convention: does a host token route to THIS host?
  * True for an absent/empty token, the `LOCAL_HOST_ID` positional sentinel, and

package/daemon/dist/domain/hosts/fanout-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"fanout-contract.js","sourceRoot":"","sources":["../../../src/domain/hosts/fanout-contract.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,uEAAuE;AACvE,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AAEvE;;kCAEkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,iEAAiE;AACjE,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,EAAiB;IAC7C,UAAU,GAAG,EAAE,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,SAAwB,UAAU;IAElC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC;AACjD,CAAC;AA6BD;;iDAEiD;AACjD,MAAM,UAAU,YAAY,CAAC,OAAmC,EAAE,eAAyB;IACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,CAAC;AAC9G,CAAC"}
+{"version":3,"file":"fanout-contract.js","sourceRoot":"","sources":["../../../src/domain/hosts/fanout-contract.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,uEAAuE;AACvE,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AAEvE;;kCAEkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,iEAAiE;AACjE,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,EAAiB;IAC7C,UAAU,GAAG,EAAE,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,kFAAkF;AAClF,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,0CAA0C;AAC1C,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoC,EACpC,SAAwB,UAAU;IAElC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC;AACjD,CAAC;AA6BD;;iDAEiD;AACjD,MAAM,UAAU,YAAY,CAAC,OAAmC,EAAE,eAAyB;IACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,CAAC;AAC9G,CAAC"}

package/daemon/dist/domain/hosts/hosts-registry-reader.d.ts

@@ -1,5 +1,14 @@
 export interface SshHostEntry {
     id: string;
+    /**
+     * The observed, immutable self-id of the host this entry points at — the JOIN KEY.
+     *
+     * `id` is MY label for that machine; `hostId` is what that machine calls itself and stamps into
+     * every envelope it sends. Optional because every entry that exists today predates the field:
+     * absent means "never learned", which resolves exactly as it does now. Nothing populates this
+     * automatically in this slice.
+     */
+    hostId?: string;
     transport: "ssh";
     target: string;
     user?: string;
@@ -7,6 +16,8 @@ export interface SshHostEntry {
 }
 export interface HttpHostEntry {
     id: string;
+    /** The observed self-id of the host this entry points at — the join key. See SshHostEntry.hostId. */
+    hostId?: string;
     transport: "http";
     url: string;
     bearer_env?: string;

package/daemon/dist/domain/hosts/hosts-registry-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosts-registry-reader.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/hosts-registry-reader.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAOjC,eAAO,MAAM,iBAAiB,aAAiE,CAAC;AAIhG,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkC,GAAG,sBAAsB,CAoBjG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,CAsGhG;AAED;;sDAEsD;AACtD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAW9E;AAED;;;;eAIe;AACf,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAUvF"}
+{"version":3,"file":"hosts-registry-reader.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/hosts-registry-reader.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAOjC,eAAO,MAAM,iBAAiB,aAAiE,CAAC;AAIhG,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkC,GAAG,sBAAsB,CAoBjG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,CA4HhG;AAED;;sDAEsD;AACtD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAsB9E;AAED;;;;eAIe;AACf,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAUvF"}